CVE-2025-23201CWE-79

Reflected Cross-site Scripting on error alert in librenms

Medium · published January 16, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting (XSS) on the parameters:`/addhost` -> param: community. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-01-16T22:18Z
EPSS history
Timeline
  • 16 JAN 22:18Z
    Reflected Cross-site Scripting on error alert in librenms
    cvelistv5